fix(worker): surface EXPIRED_LINK / INVALID_LINK instead of UNKNOWN_ERROR

Two bugs were combining to mask real failures:

1. download_file treated any non-200 HEAD as INVALID_LINK, including the
   4xx response that click.discord.com → GCS gives once the signed URL
   has expired. The user's link looked fine when they pasted it; it just
   timed out before the worker got to it.

2. process_package had `expected = ('EXPIRED_LINK')` — a string, not a
   tuple, because the parens are grouping rather than building a tuple.
   The substring check (`if expected not in current`) only recognized
   EXPIRED_LINK; INVALID_LINK and any future codes got relabeled as
   UNKNOWN_ERROR.

Net effect from the user's POV: they'd retry an expired link and see
'UNKNOWN_ERROR' three times before realizing they needed a fresh export.

Now:
- HEAD 4xx → EXPIRED_LINK (the common case for stale links).
- HEAD non-200 / wrong content-type → INVALID_LINK.
- Anything else → UNKNOWN_ERROR with the full traceback preserved.
- The expected-codes list is a real tuple containing both known codes.

Author: Androz2091

src/tasks.py

@@ -122,6 +122,14 @@ def download_file(package_status_id, package_id, link, session):
         r = requests.head(link, allow_redirects=True)
         print(r.status_code)
         print(r.headers)
+        # Discord download URLs are signed and short-lived: click.discord.com
+        # 302s to a Google Cloud Storage signed URL, which returns 4xx (most
+        # commonly 400) once the signature TTL is up. Surface that as
+        # EXPIRED_LINK so the user sees a useful message instead of the
+        # generic UNKNOWN_ERROR fallback.
+        if 400 <= r.status_code < 500:
+            print(f'Link is expired (upstream returned {r.status_code}).')
+            raise Exception('EXPIRED_LINK')
         if r.status_code != 200 or 'content-type' not in r.headers or 'application/octet-stream' not in r.headers['content-type']:
             print('The link does not point to a valid file.')
             raise Exception('INVALID_LINK')
@@ -973,10 +981,17 @@ def process_package(package_status_id, package_id, link, worker_name='regular_pr
         tb = ''.join(traceback.format_exception(type(e), e, e.__traceback__))
         print(f'process_package failed for {package_id}:\n{tb}')
 
-        expected = ('EXPIRED_LINK')
+        # Worker raises these as known error codes. Anything else gets
+        # relabeled UNKNOWN_ERROR with the full traceback preserved for
+        # CloudWatch debugging.
+        # NOTE: this used to be `expected = ('EXPIRED_LINK')` which is
+        # just the string 'EXPIRED_LINK' (Python tuples need a comma);
+        # the `in` check then accidentally did substring match on a
+        # single code, hiding INVALID_LINK behind UNKNOWN_ERROR.
+        EXPECTED_ERROR_CODES = ('EXPIRED_LINK', 'INVALID_LINK')
         current = str(e)
         e_traceback = None
-        if expected not in current:
+        if current not in EXPECTED_ERROR_CODES:
             current = 'UNKNOWN_ERROR'
             e_traceback = tb
         session.query(PackageProcessStatus).filter(PackageProcessStatus.id == package_status_id).update({